fff-bridge[.]com

The domain fff-bridge.com was registered on February 21, 2026 through NameCheap, Inc. and is configured to use the authoritative nameservers dns1.registrar-servers.com and dns2.registrar-servers.com. DNS resolution points exclusively to the IP address 64.29.17.1, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated to the United States. No TLS certificate is presented for the site, indicating that connections are served over plain HTTP only. The site’s HTML title, as captured in the intelligence feed, reads "FFF CCTP Bridge - Cross-Chain USDC Transfer," suggesting a wallet‑or seed‑phishing campaign targeting users seeking cross‑chain USDC transfers.

The domain appears on four independent security blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—and VirusTotal reports that four of ninety‑five scanned security vendors flagged the domain as malicious. Gridinsoft assigns the domain a trust score of zero out of one hundred, reinforcing the assessment of high risk. The current operational status is listed as offline, which may indicate that the malicious infrastructure has been taken down or is temporarily inactive. However, the underlying infrastructure—namely the Amazon‑hosted IP and the NameCheap registration—remains observable and could be reused for future campaigns.

Defenders should continue to monitor the IP address 64.29.17.1 for any resurgence of activity, enforce blocklist entries for the domain and its associated nameservers, and consider adding the IP to network‑level deny lists. Since the site lacks SSL, any attempted connections can be readily identified by the absence of TLS handshakes. Organizations should also educate users that legitimate cross‑chain bridge services will employ proper HTTPS certificates and will not request private keys or seed phrases via web forms. Continuous threat‑intel feeds should be consulted for any reappearance of fff-bridge.